From 3b2bab15d4bab876c77e8a43716abc3a291887db Mon Sep 17 00:00:00 2001 From: anupamme Date: Sun, 20 Sep 2026 00:53:16 +0000 Subject: [PATCH] fix: sanitize shell/subprocess call in docker_rpc.uc The run_ttyd function constructs shell commands using template literals that directly interpolate user-supplied parameters (id, cmd, port, uid) without validation --- .../root/usr/share/rpcd/ucode/docker_rpc.uc | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc b/luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc index da6bed52b..37471732e 100755 --- a/luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc +++ b/luci-app-dockerman/root/usr/share/rpcd/ucode/docker_rpc.uc @@ -316,6 +316,15 @@ function run_ttyd(request) { return { error: 'Container ID is required' }; } + // Strictly validate all user-supplied values before they are interpolated + // into a shell command string to prevent command injection. + if (!match(id, /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/) || + !match(`${port}`, /^[0-9]{1,5}$/) || int(port) < 1 || int(port) > 65535 || + (uid && !match(`${uid}`, /^[a-zA-Z0-9_-]+$/)) || + !match(cmd, /^[a-zA-Z0-9_\/.\- ]+$/)) { + return { error: 'Invalid parameter supplied' }; + } + let ttyd_cmd = `ttyd -q -d 2 --once --writable -p ${port} docker`; const sock_addr = ds.get_socket_dest();